CVE-2018-15728 Details
Description
Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://seclists.org/bugtraq/2018/Aug/49 | CVE | ExploitMailing ListThird Party Advisory |
| https://www.couchbase.com/resources/security#SecurityAlerts | CVE | |
| http://www.securityfocus.com/bid/105157 | CVE | Third Party AdvisoryVDB Entry |
| http://seclists.org/bugtraq/2018/Aug/49 | [email protected] | ExploitMailing ListThird Party Advisory |
| https://www.couchbase.com/resources/security#SecurityAlerts | [email protected] | |
| http://www.securityfocus.com/bid/105157 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| couchbase couchbase server | All versions |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Sep 26, 2019 | CVE Modified | [email protected] |
| Sep 11, 2019 | CPE Deprecation Remap | [email protected] |
| Sep 10, 2019 | CVE Modified | [email protected] |
| Oct 23, 2018 | Initial Analysis | [email protected] |
| Aug 29, 2018 | CVE Modified | [email protected] |